trader-joe-v2 does not provide any mechanism to handle the pairs with different decimal values.

Lines of code Vulnerability details Impact Joe could not able to provide the swapping/staking for pair of tokens with different decimal values. Proof of Concept To my knowledge based on the code analys, nowhere I saw the handling for pairs with different decimal values. Tools Used Vs code and joe...

Incorrect input amount calculation for Trader Joe V1 pools

Lines of code Vulnerability details Impact Input amount is calculated incorrectly for Trader Joe V1 pools when swapping tokens across multiple pools and some of the pools in the chain are V1 ones. Calculated amounts will always be bigger than expected ones, which will always affect chained swaps...

Attacker can steal entire reserves by abusing fee calculation

Lines of code Vulnerability details Description Similar to other LP pools, In Trader Joe users can call mint to provide liquidity and receive LP tokens, and burn to return their LP tokens in exchange for underlying assets. Users collect fees using collectFessaccount,binID. Fees are implemented...

Incorrect output amount calculation for Trader Joe V1 pools

Lines of code Vulnerability details Impact Output amount is calculated incorrectly for a Trader Joe V1 pool when swapping tokens across multiple pools and some of the pools in the chain are V1 ones. Calculated amounts will always be smaller than expected ones, which will always affect chained swa...